73 lines
2.0 KiB
Go
73 lines
2.0 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func newTestBroker() *broker {
|
|
return &broker{cfg: loadConfig(), sshSigner: mockSSHSigner{}}
|
|
}
|
|
|
|
func TestHandleSSHHostCert_OK(t *testing.T) {
|
|
b := newTestBroker()
|
|
body, _ := json.Marshal(sshHostCertRequest{
|
|
PublicKey: "ecdsa-sha2-nistp256 AAAAB3Nz root@fleet",
|
|
Principals: []string{"host01", "host01.fleet.lab"},
|
|
KeyID: "host01.fleet.lab",
|
|
})
|
|
req := httptest.NewRequest(http.MethodPost, "/ssh/hostcert", strings.NewReader(string(body)))
|
|
rec := httptest.NewRecorder()
|
|
|
|
b.handleSSHHostCert(rec, req)
|
|
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status = %d, body=%s", rec.Code, rec.Body.String())
|
|
}
|
|
var resp sshHostCertResponse
|
|
if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !strings.HasPrefix(resp.Cert, "ecdsa-sha2-nistp256-cert-v01@openssh.com ") {
|
|
t.Errorf("cert line = %q", resp.Cert)
|
|
}
|
|
if !strings.Contains(resp.Cert, "host01.fleet.lab") {
|
|
t.Errorf("cert should carry keyID/principals: %q", resp.Cert)
|
|
}
|
|
}
|
|
|
|
func TestHandleSSHHostCert_NoPrincipals(t *testing.T) {
|
|
b := newTestBroker()
|
|
body, _ := json.Marshal(sshHostCertRequest{PublicKey: "ecdsa-sha2-nistp256 AAAA x", KeyID: "h"})
|
|
req := httptest.NewRequest(http.MethodPost, "/ssh/hostcert", strings.NewReader(string(body)))
|
|
rec := httptest.NewRecorder()
|
|
|
|
b.handleSSHHostCert(rec, req)
|
|
|
|
if rec.Code != http.StatusBadRequest {
|
|
t.Fatalf("want 400 for missing principals, got %d", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestHandleSSHHostCert_BadJSON(t *testing.T) {
|
|
b := newTestBroker()
|
|
req := httptest.NewRequest(http.MethodPost, "/ssh/hostcert", strings.NewReader("{not json"))
|
|
rec := httptest.NewRecorder()
|
|
|
|
b.handleSSHHostCert(rec, req)
|
|
|
|
if rec.Code != http.StatusBadRequest {
|
|
t.Fatalf("want 400 for bad JSON, got %d", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestMockSSHSignerRejectsEmptyKey(t *testing.T) {
|
|
if _, err := (mockSSHSigner{}).SignHost(context.Background(), "", "h", []string{"h"}); err == nil {
|
|
t.Error("expected error on malformed public key")
|
|
}
|
|
}
|